zorp-hu

Download

zorp-hu@lists.balabit.hu

October 2009

1 discussions

tproxy - iptables - zorp
by Gabor E. Tusnady 11 Jan '10

11 Jan '10

Kedves Lista! Az augusztusi Zsiga problema, nalam nem akar megoldodni: Telepitettem egy ubuntu 8.04.3 LTS-t, megfoltoztam a kernelt es az iptables-t, hasznalom az ubuntu sajat zorp csomagjat: >uname -a Linux ujfal 2.6.24-24-386 #1 Fri Sep 18 09:10:11 CDT 2009 i686 GNU/Linux >iptables -V iptables v1.4.0 >zorpctl version Zorp 3.0.8 Revision: Compile-Date: Mar 21 2007 22:51:55 Config-Date: 2007/03/21 Trace: off Debug: off IPOptions: off IPFilter-Tproxy: off Netfilter-Tproxy: on Netfilter-Linux22-Fallback: on Linux22-Tproxy: off Conntrack: on Zorplib 3.0.6.4.2 Revision: devel(a)balabit.hu--zorp-1/zorp-lib--mainline--3.0--patch-116 Compile-Date: Jun 21 2006 01:01:55 Trace: off MemTrace: off Caps: on Debug: off StackDump: on A README-kben talalhato egyszeru test rendszert szeretnem megvalositani: >cat policy.py from Zorp.Core import * from Zorp.Http import * Zorp.firewall_name = 'z' InetZone("inter", "0.0.0.0/0", inbound_services=["io_http"], outbound_services=[]) InetZone("intra", "172.16.0.0/16", inbound_services=[], outbound_services=["io_http"]) class MyHttpProxy(HttpProxy): def config(self): HttpProxy.config(self) self.transparent_mode = 1 log("http",2,"S: %s C: %s" % (self.session.server_address.ip_s, self.session.client_address.ip_s)) def i2o_http(): Service("io_http", MyHttpProxy, InbandRouter()) Listener(SockAddrInet("a.b.c.d", 50080), "io_http", transparent=TRUE) >cat iptables.conf *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :DIVERT - [0:0] -A PREROUTING -p tcp -m socket -j DIVERT -A PREROUTING -j LOG --log-prefix "TPROXY: " -A PREROUTING -p tcp -m tcp --dport 80 -j TPROXY --on-port 50080 --on-ip a.b.c.d --tproxy-mark 0x1/0x1 -A DIVERT -j LOG --log-prefix "DIVERT: " -A DIVERT -j MARK --set-mark 0x1 -A DIVERT -j ACCEPT COMMIT *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -j LOG --log-prefix "INPUT: " COMMIT a.b.c.d a tuzfal intranet feloli ip cime. >ip rule list 0: from all lookup local 32765: from all fwmark 0x1/0x1 lookup 100 32766: from all lookup main 32767: from all lookup default elinditottam a zorpot: >strace -o log -f zorpctl start i2o_http a log socket resze: >grep setso log 4492 setsockopt(14, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 a zorp figyel az 50080-as porton: >netstat -a | grep 50080 tcp 0 0 a.b.c.d:50080 *:* LISTEN elinditok egy kapcsolatot a kliensen a 80-as porton: client>telnet x.y.z.w 80 cliensen a tcpdump: client>tcpdump -i eth0 -vvv -t port 80 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes IP (tos 0x10, ttl 64, id 57778, offset 0, flags [DF], proto TCP (6), length 60) e.f.g.h.49665 > x.y.z.w.http: S, cksum 0x2baa (correct), 886293896:886293896(0) win 5840 <mss 1460,sackOK,timestamp 3089466 0,nop,wscale 6> IP (tos 0x10, ttl 64, id 57779, offset 0, flags [DF], proto TCP (6), length 60) e.f.g.h.49665 > x.y.z.w.http: S, cksum 0x1ff2 (correct), 886293896:886293896(0) win 5840 <mss 1460,sackOK,timestamp 3092466 0,nop,wscale 6> IP (tos 0x10, ttl 64, id 57780, offset 0, flags [DF], proto TCP (6), length 60) e.f.g.h.49665 > x.y.z.w.http: S, cksum 0x0882 (correct), 886293896:886293896(0) win 5840 <mss 1460,sackOK,timestamp 3098466 0,nop,wscale 6> a serveren pedig ezt latom: server>grep 'DPT=80' /var/log/messages Sep 30 04:37:26 fal kernel: [ 4034.309881] TPROXY: IN=eth1 OUT= MAC=00:1f:c6:2f:66:03:00:1d:72:13:9f:46:08:00 SRC=e.f.g.h DST=x.y.z.w LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=57778 DF PROTO=TCP SPT=49665 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Sep 30 04:37:29 fal kernel: [ 4037.305958] TPROXY: IN=eth1 OUT= MAC=00:1f:c6:2f:66:03:00:1d:72:13:9f:46:08:00 SRC=e.f.g.h DST=x.y.z.w LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=57779 DF PROTO=TCP SPT=49665 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Sep 30 04:37:35 fal kernel: [ 4043.300099] TPROXY: IN=eth1 OUT= MAC=00:1f:c6:2f:66:03:00:1d:72:13:9f:46:08:00 SRC=e.f.g.h DST=x.y.z.w LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=57780 DF PROTO=TCP SPT=49665 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 (e.f.g.h a client ip cime, az x.y.z.w a cel gep ip cime) azaz ugyanaz a bajom, mint Bazsinak, a zorp nem kapja meg a csomagokat, de nalam az --on-ip kapcsolo nem oldja meg a problemat. lehet, hogy a verziok nem felcserelhetok, de ezzel kapcsolatban nem talalok semmi infot (sajnos a zorp-gpl kicsit elhanyagolt, pl: Zorp Tutorial Version 1.0.4 22th April, 2005, http://www.balabit.hu/network-security/gpl/tutorial/) mit neztem el, mit kell valtoztatnom, hogy a csomagok megerkezzenek a zorp-hoz? Minden segitseget elore is koszonok, tusi

4 6